1. Field of the Invention
The present invention relates generally to an electronic control apparatus that is adapted for various kinds of controls associated with the driving of a vehicle. More particularly, this invention relates to an electronic control apparatus equipped with a plurality of computers, which are functionally assigned to associated various kinds of controls including the engine control of a vehicle and which separately execute the associated controls.
2. Description of the Related Art
There are known electronic control apparatuses that perform the general electronic control of devices to be mounted on a vehicle such as the engine, transmission and suspension system. This type of electronic control apparatus comprises an arithmetic operation control circuit, which includes an input signal processing circuit, an arithmetic operation circuit, an output signal processing circuit (driving circuit) and a power circuit. One example of such an electronic control apparatus has a plurality of computers which are functionally assigned to associated various kinds of controls including the engine control and which independently execute the associated controls. The electronic control apparatus having a plurality of computers permits the individual computers to monitor the operational states of the other computers so that the operational state of the entire apparatus can be monitored.
Japanese Unexamined Patent Publication No. Sho 63-183254 discloses a computer system monitoring apparatus that has two computers (processors). As shown in FIG. 5, first and second processors 60 and 70, which constitute this monitoring apparatus, each have data bus and hand-shake bus ports 61 and 71, which are connected together by a data line and a control line 67. The processors 60 and 70 have exclusive watchdog output terminals 62 and 74 for issuing dynamic monitor signals, i.e., rectangular signals that invert every given period, to the mating processors 70 and 60. The processors 60 and 70 also have exclusive software reset output terminals 63 and 75 for issuing static reset signals, i.e., high-level or low-level signals, to the mating processors 70 and 60. The processors 60 and 70 send the monitor signals from the watchdog output terminals 62 and 74 to associated AND gates 79 and 80 via associated pumping circuits 77 and 78. Likewise, the processors 60 and 70 send the static reset signals from the reset output terminals 63 and 75 to the associated AND gates 79 and 80. The processors 60 and 70 further have watchdog detection terminals 64 and 72, which receive the monitor signals from the associated pumping circuits 78 and 77 via associated lead lines 85 and 89. The processors 60 and 70 have reset terminals 65 and 73, which receive the signals from the associated AND gates 80 and 79 via associated OR gates 82 and 81 and lead lines 86 and 90. Based on the monitor signals and reset signals acquired from the terminals 64, 72, 65 and 73, the processors 60 and 70 monitor the operational states of the other and specify an abnormality when one occurs in the engine or other location.
In the above-described monitoring apparatus disclosed in the Japanese publication, the lead lines 89 and 85 between the pumping circuits 77 and 78 and the associated watchdog detection terminals 72 and 64, and the lead lines 90 and 86 between the AND gates 79 and 80 and the associated reset terminals 73 and 65 carry high-level or low-level static signals. When any of the lead lines 89, 85, 90 and 86 is disconnected or short-circuited, therefore, the apparent signal which should be input from the disconnected or short-circuited lead line 89, 85, 90 or 86 to the associated terminals 72, 64, 73 and 65 is fixed at the low level or the high level. Accordingly, the processors 60 and 70 cannot detect the disconnection or short-circuiting of the lead line 89, 85, 90 or 86 as an abnormality. In addition, the processors 60 and 70 cannot specify the type of the abnormality.
For example, suppose a low-level signal is input to the reset terminal 73 of the second processor 70 via the lead line 90 at the normal time. Suppose that this lead line 90 is short-circuited and the second processor 70 has just failed to perform the proper operation for some reason. In this case, the first processor 60 detects through the detection terminal 64, that the watchdog signal has not been sent from the output terminal 74 of the second processor 70, and thus detects an abnormality in the processor 70. At this time, the first processor 60 sends out the reset signal from the reset output terminal 63 to reset the operation of the second processor 70. As the lead line 90 is short-circuited, however, the first processor 60 cannot supply the high-level reset signal indicative of an abnormality in the second processor 70 to the reset terminal 73 of the second processor 70. As a result, the abnormal operation of the second processor 70 cannot be stopped immediately.